Hopp til innhold

Get alerts of updates about «Privacy Policy for the COVID-19 Certificate Norway»

How often would you like to receive alerts from fhi.no? (This affects all your alerts)
Do you also want alerts about:

The email address you register will only be used to send you these alerts. You can cancel your alerts and delete your email address at any time by following the link in the alerts you receive.
Read more about the privacy policy for fhi.no

You have subscribed to alerts about:

  • Privacy Policy for the COVID-19 Certificate Norway

Article

Privacy Policy for the COVID-19 Certificate Norway

Published Updated

The Norwegian Institute of Public Health (NIPH), acting as controller, processes personal data about you in connection with your use of the COVID-19 certificate. This privacy policy explains how we process personal data about you and what rights you have.

The Norwegian Institute of Public Health (NIPH), acting as controller, processes personal data about you in connection with your use of the COVID-19 certificate. This privacy policy explains how we process personal data about you and what rights you have.


You can contact us at the following addresses:

Norwegian Institute of Public Health

Postboks 222 Skøyen

NO-0213 Oslo, Norway

Telephone: (+47) 21 07 70 00

E-mail:

1 Purpose and voluntary use

The COVID-19 certificate is a system for the secure and verified documentation of vaccination status, immunity after having had COVID-19 disease and negative test results. The certificate is based on the EU framework for digital certificates. The purpose of the COVID-19 certificate is to enable you to prove and present a personal, valid certificate both in Norway and when travelling within the EU/EEA. The COVID-19 certificate gives you access to exemptions from COVID-19 restrictions in accordance with the rules applicable in Norway at any one time. It can also provide access to exemptions which other EU/EEA countries grant their citizens based on a COVID-19 certificate.

Downloading and using the COVID-19 certificate is entirely voluntary. There is no requirement for you to have a COVID-19 certificate. There is also no requirement for you to present your COVID-19 certificate, unless stated otherwise in applicable law or regulations.

The use of COVID-19 certificates will cease when the level of infection and vaccination indicates that restrictions are no longer necessary. The EU regulations will also have an expiry date. It is up to each country to decide on the national use of COVID-19 certificates.

2 How the COVID-19 certificate works

2.1 General information concerning the issuing and use of COVID-19 certificates

You can be issued with a COVID-19 certificate if you have either 1) been vaccinated, or 2) registered a negative COVID-19 test result that is no more than 24 hours old and/or you have previously been infected with COVID-19 and registered a COVID-19 test to confirm this. See section 2.2 below for more information on this.

You can be issued with a COVID-19 certificate as a service via helsenorge.no. Data on vaccination status, previous COVID-19 history and test results is retrieved from the National Immunisation Registry (SYSVAK) and the Norwegian Surveillance System for Communicable Diseases (MSIS).

You can choose whether you want the certificate to be displayed digitally in real time, or downloaded to your mobile phone for use when you do not have an internet connection. You can also print it out on paper. When your COVID-19 certificate is checked, the inspector may also access the information which is given on the certificate.  The certificate has a QR code which is used in the verification process. The person checking the certificate will scan the QR code to verify that the certificate is valid, but not to verify the identity of the certificate holder. 

You can use two different types of control pages in the certificate: a control page with a green and red light for use within Norway, and a control page for use in the EU/EEA.  The control page for use in Norway can only be used in Norway and has a QR code which shows less comprehensive personal and health data than the equivalent European COVID-19 certificate. This is explained in more detail below. From 24 June 2021, the EU/EEA control page will be used for border crossings into Norway, into EU/EEA countries which have the same type of regulations, and other uses as stipulated in applicable law or regulations.

2.2 What is a COVID-19 certificate?

The COVID-19 certificate contains information that identifies you as an individual (name and date of birth) and three medical sections. The medical sections comprise a section which shows your vaccination status, a section which shows your COVID-19 disease history and a section which shows negative test results.

Persons who have been confirmed as having SARS-CoV-2 (the virus that causes COVID-19 disease) via a PCR test are as of May 2021 considered to be immune for a period of six months after a positive test result. This period may change (be reduced or extended) in line with any new scientific findings.

The test results include both PCR tests and rapid antigen tests. However, in order for test results to be available in the COVID-19 certificate, the test must have been performed by the health and care service and the test result must have been registered in the laboratory database belonging to the Norwegian Surveillance System for Communicable Diseases (MSIS). MSIS is used as the information source for results. Both positive and negative test results will be shown in the certificate. Positive test results are only used to document that you have been infected and had COVID-19 disease. The results of self-tests performed and read by the person being tested (without the assistance of a healthcare professional) will not be shown on the COVID-19 certificate. Results from mass testing performed at schools and elsewhere will also not be shown.

2.3 COVID-19 certificates for use in the EU/EEA

The EU has decided that a European COVID-19 certificate is to be established to facilitate greater cross-border mobility; see Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic and Regulation (EU) 2021/954 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) with regard to third-country nationals legally staying or residing in the territories of Member States during the COVID-19 pandemic.

The EU regulations establish a common legal and technical framework for the issuance, verification and acceptance of COVID-19 certificates within the EU/EEA. Citizens of Member States will be entitled to be issued a COVID-19 certificate, either digitally or in paper format. It will be possible to verify certificates in a Member State other than that in which it was issued, enabling travellers to prove their vaccination status, COVID-19 history and test results. A valid COVID-19 certificate will not be a precondition for travel in the EU/EEA. It will be up to each Member State to decide how the certificates will be used and the entry restrictions and infection control restrictions that are to apply. The main purpose is to facilitate the free movement of individuals during the pandemic. The regulations also state that citizens of countries outside the EU/EEA area who are staying or residing in the common travel area will be covered by the COVID-19 certificate scheme.

2.4 COVID-19 certificates for use in Norway

A COVID-19 certificate has been created for domestic use in Norway. This certificate is based on information concerning test results, vaccination status and previous COVID-19 history, but detailed health data will not be visible as is the case with the control page intended for use in the EU/EEA. The QR code will show whether the certificate is green or red, along with minimal personal data. The simplified version can therefore only be used for domestic use in Norway, where it is not necessary to distinguish between test results, vaccination status and previous COVID-19 history.

2.5 More information about the display and scanning of COVID-19 certificates

For use in Norway, a separate verification app (scanner) is being developed based on technology from Google and Apple with functionality to verify that the COVID-19 certificate is valid by scanning the QR code on the COVID-19 certificate. The information that is collected during the scanning process is displayed to the inspector, but will not be forwarded or stored in the scanner. 

The QR code on the European COVID-19 certificate will include more personal data than the national COVID-19 certificate. See section 4 below regarding the information that the two COVID-19 certificates contain.

3 Legal basis

As regards the processing of personal data that is necessary for the issuing and verification of COVID-19 certificates to facilitate free movement within the EEA (the European COVID certificate), the legal basis is Section 4A-1 of the Norwegian Control of Communicable Diseases Act (Smittevernloven) and EU Regulations 2021/953 and 2021/954 on the EU Digital COVID Certificate for EU/EEA citizens and citizens of third countries; see the GDPR, Article 6 (1)(c) (legal obligation) and/or (e) (task in the public interest), see 3 and Article 9 (2)(g) on the processing of special categories of personal data which is necessary for reasons of substantial public interest.

Regarding the processing of personal data concerning the national COVID-19 certificate, the legal basis is the more detailed rules which provide for and regulate use of the certificate within Norway; see Section 4A-2 of the Control of Communicable Diseases Act; see the GDPR, Article 6 (1)(c) (legal obligation) and/or (e) (task in the public interest), see (3) and Article 9 (2)(g), and (i) concerning public health considerations.

No one may be treated differently as a result of being unable to present a COVID-19 certificate, unless provisions issued in or pursuant to the law permit otherwise. Provisions stipulating that COVID-19 certificates are the only acceptable documentation can only be introduced when deemed necessary with effective and secure verification, and when such provisions would not be disproportionate given the nature of the infection control measure concerned and the circumstances. This means that it must be stipulated in a law or regulation that an inspector must have legal access to use COVID-19 certificates as a basis for the control and positive discrimination of you, and that such use cannot be disproportionate. More detailed regulations concerning the use of COVID-19 certificates may be introduced in the COVID-19 Regulation and the Regulation on entry restrictions for foreign nationals for public health reasons.

For updated information on areas of use, see Helsenorge 

The legal basis for the use of COVID-19 certificates in other countries will follow from the national law of the country concerned.

4 What personal data is processed and included in the COVID-19 certificate

4.1 National COVID-19 certificates

The national COVID-19 certificate includes the following information:

  • Parts of the name, First letter of the first name, three letters of the surname
  • Year of birth
  • Validity 

4.2 EU COVID-19 certificates

4.2.1 Common information

The EU COVID-19 certificate includes three medical sections regarding vaccination, tests and immunity respectively. The following personal data is covered by all three sections: the sub-certificates:

  • Full name
  • Date of birth

The medical sections also contain the information stated below.

4.2.2 Vaccination

  • Vaccine type and manufacturer
  • Date of vaccination
  • Number of doses
  • Country
  • Unique identifier for vaccine dose

4.2.3 Test

  • Test method
  • Date of sampling and result
  • Test result
  • Place where the test was performed
  • Country in which the test was performed
  • Unique identifier

4.2.4 Immunity

  • Which disease
  • Date of positive test result
  • Valid from date
  • Valid to date
  • Unique identifier

4.2.5 Other information included in the certificate:

  • Issuer of certificate. [Probably "Norway" or "NIPH/FHI"]
  • When the certificate was issued. Timestamp indicating when the citizen retrieved the data from Helsenorge
  • ID of key used for signing

5 Disclosure of personal data to others

NIPH does not disclose your personal data to others.

As processor on behalf of NIPH, Norsk Helsenett SF will issue COVID-19 certificates as a service to inhabitants on helsenorge.no. An alternative solution for issuing COVID-19 certificates is available from Helfo.

When you use a COVID-19 certificate and opt to show it to an inspector in connection with verification of the certificate, the inspector will be able to access the information provided in the COVID-19 certificate when they scan the QR code, but the information will not be stored on the inspector’s device.

6 Your rights

In connection with processing of your personal data by the NIPH, you have the right to request access to the data we process about you and to ask for inaccurate information to be corrected or deleted. It is the vaccination centre or test station, which is often the municipality in which you live, that has the authority to correct or delete information in the MSIS and/or SYSVAK systems.

To view the data that is being processed about you in MSIS and/or SYSVAK, you can request access to it via helsenorge.no or submit a form to the Norwegian Institute of Public Health:

If you have any questions about how the Norwegian Institute of Public Health processes your personal data, please feel free to contact our Data Protection Officer by sending an email to 

7 Complaints

You can complain about the way in which NIPH processes personal data. In such a case, we would ask you to contact us so that we have the opportunity to decide on the enquiry and possibly change the way we process your data. You can also complain to the Norwegian Data Protection Authority. The Norwegian Data Protection Authority is an independent authority that oversees compliance with the rules on data protection in Norway. You can find information about the Norwegian Data Protection Authority, and how to complain, on the Norwegian Data Protection Authority website.

History

08.07.2021: Chapter 2,1, this sentence is removed: COVID-19 certificates can therefore only be used together with proof of ID which is presented manually.